Privacy policy for Outdoorchef

Privacy policy for Outdoorchef

We are delighted that you have visited our website and would like to inform you about how we handle your personal data in accordance with Article 13 of the General Data Protection Regulation (GDPR) below.

1. Controller
The controller responsible for the data collection and processing described below is

Outdoorchef AG
Eggbühlstrasse 28
8050 Zurich, Switzerland
E-mail address marcom@outdoorchef.com
www.outdoorchef.com

Furthermore, the following Outdoorchef subsidiaries may also have responsibility as controllers. As an example, this is the case if you apply to one of these companies for a job, order a product from this subsidiary or complain to this subsidiary about a product:

Germany:
Outdoorchef Deutschland GmbH
Ochsenmattstrasse 10
79618 Rheinfelden, Germany
E-mail address marcom@outdoorchef.com

Benelux:
Outdoorchef Benelux B.V.
Databankweg 26
3821 AL Amersfoort, Niederlande

Austria:
Outdoorchef Austria GmbH
Handelskai 94-96/23 and 24
1200 Vienna, Austria
E-mail address: marcom@outdoorchef.com

2. Overview of our data protection information

Privacy policy for Outdoorchef 
1. Controller 
2. Overview of our data protection information 
3. Data processing when operating our web pages 
    3.1. Usage data 
    3.2. Cookiebot consent banner 
    3.3. Use of cookies and similar technologies 
    3.3.1. Explanations 
    3.3.1.1. Cookies 
    3.3.1.2. Local storage 
    3.3.1.3. Pixels 
    3.3.1.4. Tags 
    3.3.2. Browser settings and consent banner management 
    3.3.3. Categories 
    3.3.3.1. Cookies and similar technologies required for technical purposes 
    3.3.3.2. Cookies and similar technologies to manage convenient functions and preferences 
    3.3.3.3. Statistical cookies and similar technologies for analysing website visits 
    3.3.3.4. Tracking cookies and similar tracking technologies 
    3.3.4. Managing your settings—withdrawing consent 
    3.4. Google Tag Manager 
    3.5. Website analysis and tracking services 
    3.5.1. Google Analytics 
    3.5.2. Google Ads Conversion Tracking 
    3.6. YouTube 
    3.7. Google Web Fonts 
    3.8. Contact forms 1
    3.9. Newsletter and newsletter tracking, shopping cart reminder e-mails 
4. Data processing when operating our Shopify online shop 
    4.1. Guest checkout without registration 
    4.2. Registering in the online shop—customer account 
    4.3. Contractual performance 
    4.3.1. Contract conclusion and processing, termination and recission as well as shipment 
    4.3.2. Payment processing 
    4.3.2.1. PayPal 
    4.3.2.2. Shopify Payments 
    4.3.2.3. Klarna 
    4.3.2.4. Credit card payment 
    4.3.2.5. Bank transfer 
    4.3.2.6. Purchase on account 
    4.3.3. Credit checks 
    4.4. Legal defence 
    4.5. Changing your data and erasing your data and the customer account 
5. Cross-divisional data processing 
    5.1. Data processing for product support 
    5.2. Data processing for quality assurance 
    5.2.1. Selection and analysis of electronic correspondence 
    5.3. Data processing for marketing purposes 
    5.4. Data processing for surveys 
    5.5. Data processing for communication processing by customer services/telephone services 
    5.6. Data processing for the assertion, exercise or defence of legal claims, cooperation with debt collection agencies 
    5.7. Data processing to document compliance with data protection 
    5.8. Data processing for the fulfilment of other legal obligations 
6. Recipients of personal data 
7. Storage period 
8. Voluntary nature of the provision of your data 
9. Your rights 
    9.1. Right of access (Article 15 of the GDPR) 
    9.2. Right to rectification (Article 16 of the GDPR) 
    9.3. Right to erasure (17 of the GDPR) 
    9.4. Right to restriction of processing (Article 18 of the GDPR) 
    9.5. Right to data portability (Article 20 of the GDPR) 
    9.6. Right to object (Article 21 of the GDPR) 
    9.7. Right of withdrawal (Article 7 [3] [1] of the GDPR) 
    9.8. Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR) 
10. Data protection officer contact details 
11. Changes to this privacy policy 

3. Data processing when operating our web pages
We would like to inform you about how we handle your personal data when you visit our website below.

3.1. Usage data
When you visit our web pages, “usage data” is temporarily processed on our web server in order to technically enable you to access our web pages.

This data record consists of:
• the name and address of the content requested;
• the date and time of the request;
• the amount of data transferred;
• the access status (content transferred, content not found);
• the description of the web browser and operating system used;
• the referral link, which indicates the page from which page you accessed our page; and
• the IP address of the requesting computer, which is truncated so that a personal reference can no longer be made.

We process your usage data in accordance with Article 6 (1) (f) of the GDPR which is in our legitimate interest in being able to provide you with a functional website.

Subsequently, the data records are anonymised by shortening your IP address in order to be able to evaluate them for statistical purposes to improve the quality of our web pages and store them in a log.

3.2. Cookiebot consent banner
We use the “Cookiebot” consent banner on our web pages, which is from the provider Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, and is within the scope of a commissioned processing relationship according to Article 28 of the GDPR.

Data processing by Cookiebot is carried out on the basis of Article 6 (1) (f) of the GDPR for the purpose of and in our legitimate interest to be able to use cookies and similar technologies on our web pages in a way that is compliant with data protection regulations and to allow you to easily withdraw your declarations of consent.

If you provide consent via our consent banner, Cybot processes the following data:
• your IP address;
• the date and time consent is given;
• the user agent for the end user’s browser;
• the URL from which consent was sent;
• a pseudonymous, random and encrypted key; and
• your consent status, which serves as proof of your consent.

Your data is logged on Cybot’s servers. Your IP address is truncated by removing the last three digits so that it is no longer possible to make a personal reference.

Your key and consent status are also stored in the “CookieConsent” cookie in your end device’s browser for a period of 12 months.

This is how our website is able to check your consent status on all subsequent and future page views and how cookies and other technologies are enabled or disabled based on your decision to use them when you return to the page.

Verification takes place by matching the key and consent status from the “CookieConsent” cookie with the values provided to Cybot when you gave your consent to ensure that the status of the consent you originally gave has not changed.

For more information about how Cybot handles personal data, please visit https://www.cookiebot.com/de/privacy-policy/.

3.3. Use of cookies and similar technologies
We use cookies and similar technologies on our web pages. In the following, we will explain which ones they are and how you can control their use in your browser or via our consent banner.

3.3.1. Explanations

3.3.1.1. Cookies
Cookies are small text files that are saved on your end device and can be read.
A distinction is made between session cookies, which are deleted as soon as you close your browser, and permanent cookies, which are saved after the individual session. Information on the storage period for permanent cookies can be found in the tables below.

3.3.1.2. Local storage
In addition to cookies, we also use your browser’s local storage memory to store and read data.
In many cases, you can change your browser settings so that it notifies you about saving data in local storage. This makes the storage of this data transparent for you. In addition, you can delete local storage memory if necessary by changing your browser settings and preventing new data from being saved.

3.3.1.3. Pixels
We also incorporate pixels into our web pages where appropriate. Pixels are small individualised image files that are loaded when a page loads and can be used to track user activity.

In many cases, you can change your browser settings so that it notifies you about pixels. This makes the storage of this data transparent for you. In addition, you can stop pixels from being downloaded if necessary by changing the appropriate browser settings and preventing new data from being saved.

3.3.1.4. Tags
Finally, we may use tags on our web pages. Tags are small HTML or JavaScript code fragments or markers that allow website analysis or user tracking services to distinguish or identify users and track specific user activity.

3.3.2. Browser settings and consent banner management
You can change your browser settings so that you are notified if cookies are saved on your machine. In addition, you can delete cookies via the appropriate browser settings and prevent new cookies from being saved.

In many cases, you may be able to change your browser settings via browser extensions or add-ons so that you are also notified about data being saved in local storage memory and pixel tags being downloaded or executed.

This makes saving, reading, downloading or executing data in cookies and similar technologies transparent for you.

In addition, you can manage the use of cookies and similar technologies on our web pages via our consent banner by giving or withdrawing your consent there.

Please note that without the use of certain cookies and similar technologies, our web pages may not be displayed correctly and some functions may no longer be available from a technical perspective.

3.3.3. Categories

3.3.3.1. Cookies and similar technologies required for technical purposes
We use cookies and similar technologies on our web pages which are required from a technical perspective to use our web pages.

We do not use these cookies and similar technologies required for technical purposes for analysis, tracking or advertising purposes.

In part, these cookies and similar technologies only contain information about certain settings and are not personally identifiable. They may also be necessary to enable user guidance, security and presentation with respect to our web pages.

We use these cookies and similar technologies which are required for technical purposes on the basis of Article 6 (1) (f) of the GDPR which is in our legitimate interest in providing you with a functional and secure website.
We set out cookies and similar technologies required for technical purposes below, in addition to third-party providers with which we cooperate on how these are used, if applicable.

If data is processed outside the EU or the EEA in this context, we have taken measures to ensure an adequate level of data protection in accordance with Article 44 et seq. of the GDPR.

3.3.3.2. Cookies and similar technologies to manage convenient functions and preferences
To make our website more appealing to you, we use cookies and similar technologies through which your personal settings for the display and use of our website are saved. The cookies ensure that your settings are automatically reloaded when you access our web pages at a later point in time.

Data processing is based on your consent according to Article 6 (1) (a) of the GDPR, provided that you have given your consent via our consent banner. 

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR. You can find out how to exercise your right to withdraw consent in Section 3.3.4 “Managing your settings—withdrawing consent”.

We set out cookies and similar technologies, in addition to third-party providers with which we cooperate on how these are used, if applicable, within the scope of managing convenient functions and preferences.

If data is processed outside the EU or the EEA in this context, we have taken measures to ensure an adequate level of data protection in accordance with Article 44 et seq. of the GDPR.

3.3.3.3. Statistical cookies and similar technologies for analysing website visits
We use cookies and similar technologies to create user profiles based on pseudonyms to design our web pages in a way that meets our customers’ needs. For this purpose, information is stored on your end device and read by us.

In addition, we may retrieve recognition features for your browser or end device (e.g. a “browser fingerprint” or your unabbreviated IP address). This is how we are able to recognise returning visitors and count them as such.

Data processing is based on your consent according to Article 6 (1) (a) of the GDPR, provided that you have given your consent via our consent banner.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR. You can find out how to exercise your right to withdraw consent in Section 3.3.4 “Managing your settings—withdrawing consent”.

We set out cookies and similar technologies, in addition to third-party providers with which we cooperate on how these are used, if applicable, as part of analysing website visits.

If data is processed outside the EU or the EEA in this context, we have taken measures to ensure an adequate level of data protection in accordance with Article 44 et seq. of the GDPR.

3.3.3.4. Tracking cookies and similar tracking technologies
We use tracking cookies and similar tracking technologies to allow us to provide you with cross-device targeted advertising on third-party websites based on your visit to our web pages and to help us to understand how effective our advertising campaigns have been.

When you visit our web pages, the aforementioned third-party providers may retrieve recognition features for your browser or end device (e.g. a “browser fingerprint”), evaluate your IP address, store or read recognition features on your end device (e.g. cookies or data in local storage) or gain access to data through individual tracking pixels, web beacons or other tracking tags (markers).

The third-party providers can use individual characteristics to recognise your end device on other Internet pages. We can commission the relevant third-party providers to display advertisements based on the pages visited on our site.

If you sign into the third-party provider with your own user data, the respective recognition features of different browsers and end devices can be linked together. So, for example, if the third-party provider has created a separate characteristic for the laptop, desktop PC or smartphone or tablet you use, these individual characteristics can be linked together as soon as you use a service of the third-party provider with your login details. This is how the third-party provider can also manage our advertising campaigns across different end devices in a targeted way.

Data processing is based on your consent according to Article 6 (1) (a) of the GDPR, provided that you have given your consent via our consent banner.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR. You can find out how to exercise your right to withdraw consent in Section 3.3.4 “Managing your settings—withdrawing consent”.

We set out tracking cookies and similar tracking technologies, in addition to third-party providers we work with on user tracking for advertising purposes below.

If data is processed outside the EU or the EEA in this context, we have taken measures to ensure an adequate level of data protection in accordance with Article 44 et seq. of the GDPR.

3.3.4. Managing your settings—withdrawing consent
You can change any settings you have made via our cookie consent banner at any time in order to exercise your right to withdraw your consent in accordance with Article 7 (3) of the GDPR.

You can manage your settings here.

3.4. Google Tag Manager
Our web pages use the “Google Tag Manager” from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), Google Tag Manager is provided as a service from Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager is a tag management system (TMS) that allows us to integrate and manage additional website content in JavaScript or HTML code.

In particular, “tags” can be integrated and managed on our website. Tags are small fragments of code or markers (web beacons, tracking pixels, or similar markers) that facilitate website analytics or user tracking services to distinguish or identify users.

Website visit analysis or user tracking is not carried out by Google Tag Manager, but by the services used for these purposes, such as Google Analytics or other third-party solutions. Instead, Google Tag Manager is only used to integrate and manage the tags necessary for analysis or tracking into our website.

As Google Tag Manager is provided by Google and is reloaded from its servers when the page is accessed, the usage data required for technical purposes for accessing the page is also transmitted. Google also receives your IP address, which is required for technical purposes to retrieve the content.

Data processing is based on Article 6 (1) (f) of the GDPR. The purpose and our legitimate interest is to make the administration of our website content efficient.

Data processing may also take place in third countries outside the EU or EEA.

There is a risk that authorities in third countries may access the data for security and surveillance purposes without notifying you or allowing you to seek legal remedy.
We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks.

We have no control over further data processing by third-party providers.

For more information about how Google handles personal data, please visit https://policies.google.com/privacy?hl=de.

3.5. Website analysis and tracking services

3.5.1. Google Analytics
We use the web analysis service “Google Analytics” from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA, to design our web pages in a needs-based way.

In the European Union (EU) and the European Economic Area (EEA), Google Analytics is offered as a service from Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland, which supports us as a processor in accordance with Article 28 of the GDPR.

Google Analytics creates usage profiles based on pseudonyms and usage data. User interactions such as button clicks, scroll depth and the use of filtering and search functions are also collected.

For this purpose, permanent cookies are stored on your end device and read by us. This is how we are able to recognise returning visitors and count them as such.

Data processing is based on your consent according to Article 6 (1) (a) of the GDPR, provided that you have given your consent via our consent banner.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR. You can find out how to exercise your right of withdrawal at 3.3.4 “Managing your settings—withdrawing consent”.

Data processing may also take place in third countries outside the EU or EEA.

There is a risk that authorities in third countries may access the data for security and surveillance purposes without notifying you or allowing you to seek legal remedy.

We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks.

Collected data will be stored by us in Google Analytics for a period of 14 months.

We have no control over further data processing by third-party providers.

For more information about how Google handles personal data, please see https://policies.google.com/privacy?hl=de.

3.5.2. Google Ads Conversion Tracking
We integrate “Google Ads Conversion Tracking” into our web pages, which is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), Google Ads Conversion Tracking is provided as a service from Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland.

If an ad placed by us via Google Ads is displayed to you on other websites or if you click on it, these other websites will store a Google Ad Conversion Tracking cookie with a pseudonym assigned to us on your end device on the basis of your consent given there.

If you then visit our website within this cookie’s storage period, this cookie will be read by Google Ad Conversion Tracking on our website. This is how Google can determine that you have been shown an advertisement placed by us or that you have clicked on it and subsequently visited our web pages and, if applicable, how you have subsequently used our web pages. In particular, information regarding whether or not you have purchased an advertised item in our online shop is collected.

The conversion of an advertisement into action carried out by the website visitor is called a conversion.

Based on this information, Google Ads creates statistics for us, from which we can see how many users have responded to our ads and in what way. We can use these statistics to optimise how effective our advertising is and to manage our advertising strategy.

Data processing is based on your consent according to Article 6 (1) (a) of the GDPR, provided that you have given your consent via our consent banner.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR. You can find out how to exercise your right to withdraw consent in Section 3.3.4 “Managing your settings—withdrawing consent”.

Data processing may also take place in third countries outside the EU or EEA.

There is a risk that authorities in third countries may access the data for security and surveillance purposes without notifying you or allowing you to seek legal remedy.

We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks.

We have no control over further data processing by third-party providers.

For more information about how Google handles personal data, please visit https://policies.google.com/privacy?hl=de.

3.6. YouTube
In addition to YouTube videos that are simply linked to, we also integrate videos into our web pages via the “YouTube” video platform from Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

In the EU and the European Economic Area (EEA), YouTube is provided as a service from Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland.

Since embedded videos are reloaded from the servers of third-party provider video platforms when the page is accessed, the usage data required for technical purposes for accessing the page is also transmitted.

The third-party provider also receives your IP address, which is required for technical purposes to retrieve the content.

Integration is based on Article 6 (1) (f) of the GDPR and is in the interest of making our site as appealing and informative as possible.

When integrating videos, cookies and other technologies are also stored and read by the providers of the video platforms on your end device. We have no control over further data processing by third-party providers.

Data processing may also take place in third countries outside the EU or EEA.

There is a risk that authorities in third countries may access the data for security and surveillance purposes without notifying you or allowing you to seek legal remedy.

We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks.

For more information about how Google handles personal data, please see https://policies.google.com/privacy?hl=de.

3.7. Google Web Fonts
We integrate “Google Web Fonts” into our web pages, which is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA.

In the European Union (EU) and the European Economic Area (EEA), Google Web Fonts is provided as a service from Google Ireland Limited Gordon House, Barrow Street, Dublin 4, Ireland.

As Google Web Fonts is provided by Google and is reloaded from its servers when the page is accessed, the usage data required for technical purposes for accessing the page is also transmitted. Google also receives your IP address, which is required for technical purposes to retrieve the content.

Data processing is based on Article 6 (1) (f) of the GDPR. The purpose and our legitimate interest is to make our web pages appealing.

Data processing may also take place in third countries outside the EU or EEA.

There is a risk that authorities in third countries may access the data for security and surveillance purposes without notifying you or allowing you to seek legal remedy.

We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks.

We have no control over further data processing by third-party providers.
For more information about how Google handles personal data, please visit https://policies.google.com/privacy?hl=de.

3.8. Contact forms
You have the option of contacting us about various topics via our contact forms, e.g. “Technical questions”, “Questions about the order” and “Other questions”.
For use, we collect the necessary data such as the title, first name, last name, street and house number, postcode, town or city, e-mail address and, for questions about the order, the order number.

Depending on the type of form used, we may process other mandatory data (customer name/customer e-mail address, order number/customer number, or information on what your enquiry is about). We use this data to be able to respond to your enquiry.

The legal basis for data processing is our legitimate interest in being able to process and respond to your enquiry quickly and comprehensively, pursuant to Article 6 (1) (f) of the GDPR.

In addition, and depending on the form, you can decide for yourself whether you would like to provide us with further details (telephone number, country of purchase, date of purchase, barbecue model, item number, serial number, and receipt upload). This information is provided on a voluntary basis and is not mandatory for registering/submitting your contact request.

The legal basis for data processing with respect to data provided on a voluntary basis is your consent according to Article 6 (1) (a) of the GDPR.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR. For this purpose, please use the e-mail address mentioned above under “Controller”.

You can also fill out the warranty form. Here, we collect the data required for processing: title, first name, last name, street and house number, postcode, town or city, e-mail, telephone number, date of purchase, item number, serial number and your uploaded receipt.

The legal basis for this data processing is the fulfilment of the guarantee or contract in accordance with Article 6 (1) (b) of the GDPR.

Our event form is for contacting us regarding our barbecue courses and events. Here, we collect the data required for further processing: title, first name, last name, company (voluntary), street and house number, postcode, town or city, e-mail address, telephone number, desired date, alternative date, number of participants, start of event and location (on Outdoorchef’s premises or on your own premises).

The legal basis for this data processing is the fulfilment or initiation of the contract.

All forms also require you to enter a message.

3.9. Newsletter and newsletter tracking, shopping cart reminder e-mails
On our web pages, we give you the option of subscribing to our newsletter and other electronic news.

As part of the registration process, we will process your e-mail address to inform you by e-mail about our products, services, events and promotions in our online shop or other current promotions or products from, as an example, other group companies within Diethelm Keller Brands.

In addition, as part of our newsletter tracking, we process data concerning the time you open the newsletter and concerning your other interactions with newsletter content, e.g. clicks on further links or the percentage of our newsletter you have read. We process this data to check the effectiveness of our newsletter distribution and to optimise our newsletter content.

The legal basis for data processing is your consent according to Article 6 (1) (a) of the GDPR.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR.

If you do not wish to receive future messages, you can unsubscribe at any time. To do so, use the unsubscribe link that you will find in every newsletter e-mail.

Alternatively, you can also unsubscribe by sending an e-mail to the e-mail address mentioned above under “Controller”, declaring that you would like to withdraw your consent.
Please note that, in addition to the newsletter, you may also receive e-mails from us if you have consented to us sending you shopping cart reminder e-mails or “abandoned shopping cart e-mails” to remind you that you have abandoned a purchase and to let us know whether you are still interested in the items.

The legal basis for data processing is your consent according to Article 6 (1) (a) of the GDPR.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future in accordance with Article 7 (3) of the GDPR.

If you no longer wish to receive such shopping cart reminder e-mails, you can use the unsubscribe link provided in each shopping cart reminder e-mail.

For newsletter dispatch and tracking and for shopping cart reminder e-mails, we transmit your data to the service provider “Klaviyo”, 225 Franklin St. Boston, Massachusetts 02110 , USA, which is bound by our instructions and is contractually obligated to us accordingly, within the scope of commissioned processing pursuant to Article 28 of the GDPR.

Data processing may also take place in third countries outside the EU or EEA.

There is a risk that authorities in third countries may access the data for security and surveillance purposes without notifying you or allowing you to seek legal remedy.

We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks.

4. Data processing when operating our Shopify online shop
Below, we would like to inform you about how we handle your personal data when you use our online shop.

Our online shop is hosted and provided as a Shopify Plus store by Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. This company acts for us as a central service provider for the online shop and, as part of its activities, may also transmit personal data to its parent company, Shopify Inc, 151 O'Connor Street, Ground floor, Ottawa, ON K2P 2L8, Canada, to the extent required. A commissioned processing agreement has been concluded with each of them. Insofar as processing takes place in Canada, an adequate level of data protection is ensured by an adequacy decision pursuant to Article 45 of the GDPR, https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002.

Various data processing, services or support services, for which you will find more detailed information under the sub-headings, are provided by various companies and corporations that act jointly as “Shopify”.

Information on data protection at Shopify and the precautions taken by Shopify to comply with GDPR requirements can be found at https://www.shopify.de/legal/datenschutz and at https://www.shopify.com/legal/privacy/customers.

4.1. Guest checkout without registration
You have the option of placing an order in our online shop without prior registration.

In this case, we only process data required to conclude or process a contract or, if applicable, to terminate and rescind a contract as well as data required to ship your order, as described below in Section 4.3.1“Contract conclusion and processing, termination and recission as well as shipment”.

For guest orders, you cannot enter billing or shipping addresses or payment information. You will also not be able to view your previous orders or any barbecues that may have already been registered to you.

4.2. Registering in the online shop—customer account
If you would like to manage your billing or shipping addresses, store payment information, or access information relating to your previous orders, you can also register for our online shop with a customer account.

You can also access helpful services through your customer account, such as viewing your previous orders as well as an overview of your barbecues that have already been registered.

During registration, we process your first and last name, your e-mail address and title as well as your address with the postcode and country.

The legal basis for processing your data is Article 6 (1) (b) of the GDPR.
If you register in our online shop as an employee of a company or organisation as an authorised representative, your data will be processed in accordance with Article 6 (1) (f) of the GDPR.

4.3. Contractual performance

4.3.1. Contract conclusion and processing, termination and recission as well as shipment
If you decide to purchase products, in addition to the above data, we process further data which we use for fulfilment and, if necessary, to rescind the purchase agreement in the context of the termination of the contract, to ship the goods and to inform you about the status of the order.

This additional data is the title, first name, last name, address and telephone number.

Furthermore, in the context of executing an order, an order number is also assigned for administrative purposes and is processed further in the context of processing, if necessary, rescinding the purchase agreement in the event that the contract is terminated.

As the order may be shipped by a carrier or—if you have ordered this—a service provider may set up the barbecue on your premises (installation service), we may also pass on your contact details to transport service providers so that they can contact you for shipment archiving.

The legal basis for processing your data is Article 6 (1) (b) of the GDPR.

4.3.2. Payment processing
We also process personal data on the basis of Article 6 (1) (a) or (b) of the GDPR within the framework of payment processing, depending on the payment method you have chosen.

4.3.2.1. PayPal
If you use PayPal, we process your PayPal username and the data required for payment processing for your order.

We transmit this data to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

PayPal (Europe) S.à r.l. et Cie, S.C.A. will then process your data independently for its own purposes, such as carrying out a credit check.

Further information on data processing by PayPal (Europe) S.à r.l. et Cie, S.C.A. can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

The legal basis for transmitting your data to PayPal (Europe) S.à r.l. et Cie, S.C.A. is your consent in accordance with Article 6 (1) (a) of the GDPR.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future.

Data transmission carried out straight after the purchase confirmation in the ordering process therefore remains lawful even if you exercise your right of withdrawal.

4.3.2.2. Shopify Payments
If you use Shopify Payments, we will process your Shopify Payments username and information about your order that is required for payment processing.

We transmit this data to Shopify, which then independently processesyour data for its own purposes, such as carrying out a credit check.

Information on data protection at Shopify and the precautions taken by Shopify to comply with GDPR requirements can be found at https://www.shopify.de/legal/datenschutz and at https://www.shopify.com/legal/privacy/customers

The legal basis for transmitting your data is your consent according to Article 6 (1) (a) of the GDPR.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future.

Data transmission carried out straight after the purchase confirmation in the ordering process therefore remains lawful even if you exercise your right of withdrawal.

4.3.2.3. Klarna
If you select “Klarna” as payment option, the data required for further payment processing will be transmitted to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden.

Klarna Bank AB (publ) will then independently process your data for its own purposes, such as establishing your identity or carrying out a credit check.

If you decide to use Klarna’s payment services, we ask for your consent so that we can transmit the data required to process the payment and carry out an identity and credit check to Klarna. In Germany, the credit agencies mentioned in Klarna’s privacy policy may be used for identity and credit checks. You can withdraw your consent to this use of personal data at any time.

The legal basis for transmitting your data is your consent according to Article 6 (1) (a) of the GDPR.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future.

Data transmission carried out straight after the purchase confirmation in the ordering process therefore remains lawful even if you exercise your right of withdrawal.

4.3.2.4. Credit card payment
For credit cards, we process data concerning your credit card provider, the card number, the name of the cardholder, the expiry date and the card verification number.

We transmit this data to your bank or credit card provider and to Shopify if you place an order in Germany, Austria or Benelux, or we send it to PostFinance Mingerstrasse 20, 3030 Bern, Switzerland, if you order in Switzerland.

These service providers support us in the processing of payments and the associated processes.

The legal basis for transmitting your data is Article 6 (1) (b) of the GDPR.

4.3.2.5. Bank transfer
For manual transfers, we process the name of the account holder, the IBAN and the BIC.

The legal basis for transmitting your data is Article 6 (1) (b) of the GDPR.

4.3.2.6. Purchase on account
For purchase on account (this is only offered for orders from Switzerland and Germany) we process the name of the account holder, the IBAN and the BIC.

As our service provider Shopify works with Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden for orders from Germany, your data will be transmitted to them.

Klarna Bank AB (publ) will then independently process your data for its own purposes, for example carrying out a credit check.

For further information on data processing by Klarna Bank AB (publ), please see https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy.

The legal basis for transmitting your data to Shopify or to Klarna Bank AB (publ) is your consent in accordance with Article 6 (1) (a) of the GDPR.

Your consent is voluntary and can be freely withdrawn at any time with effect for the future.

For orders from Switzerland, you will then receive an invoice from Outdoorchef AG.

4.3.3. Credit checks
If you order something from the online shop via our customer services and decide to purchase on account, we may carry out a credit check for new customers or depending on the total price of the goods ordered and we will transmit and process the personal data required for the credit check and assessment.

We process stored address and credit check data, including data on the statistical probability of a payment default, to make a weighed decision on the establishment, implementation or termination of the contractual relationship.

The credit report may contain probability values (score values), which are calculated on the basis of scientifically recognised mathematical-statistical methods and where calculation includes, among other things, address data.

Processing is carried out for the purpose and in the interest of facilitating a credit check with a credit agency and thus allowing us to assess the financial risk associated for us with purchase on account.

The legal basis for processing your data is Article 6 (1) (f) of the GDPR.

4.4. Legal defence
In addition, we process your data in individual cases for the purpose and in the interest of asserting legal claims, for example to enforce our receivables due to unpaid invoices.

Finally, we process your data in individual cases for the purpose of and in the interest of defending legal claims that are raised against us, for example, when material defect liability claims are asserted.

The legal basis for processing your data is Article 6 (1) (f) of the GDPR.

If necessary, your data will be transmitted to investigating authorities, debt collection agencies, lawyers, experts, courts or bailiffs in individual cases to the required extent.

4.5. Changing your data and erasing your data and the customer account
You can change the data in your customer account or delete the account at any time. You can request changes and deletions at any time by contacting marcom@outdoorchef.com.

5. Cross-divisional data processing
In the following, we would like to inform you about how we handle your personal data outside of our web pages, our online shop and our stores.

5.1. Data processing for product support
To provide you with support and assistance with respect to products bought from our online shop as an additional service and to fulfil your claims under warranty law, we process personal data such as your name, address, telephone number, e-mail address and the ticket number relating to your enquiry or support request.

The legal basis for processing your data is Article 6 (1) (b) of the GDPR.

5.2. Data processing for quality assurance

5.2.1. Selection and analysis of electronic correspondence
To train and educate our service staff and to ensure and improve the quality of our customer services, we process your personal data from electronic correspondence and conversations between you and us in e-mails to be able to select suitable examples randomly or based on certain events. The selected examples will be anonymised before further use.

The legal basis for processing your data is Article 6 (1) (f) of the GDPR.

5.3. Data processing for marketing purposes
In addition, insofar as the data protection requirements are met, we process your personal data to contact you by post, telephone and e-mail and to be able to make you or your company offers tailored to your individual needs in this way.

5.4. Data processing for surveys
Furthermore, we may process personal data from you in the context of surveys. We conduct these surveys based on our legitimate interest in finding out what you like about our products and what you think we could improve.

We use SurveyMonkey Europe UC, 2nd Floor, 2 Shelbourne Buildings, Shelbourne Road, Dublin, Ireland for our surveys. As an example, they collect device information or log data—such as your IP address—to prevent misuse and errors and also use tracking technologies by means of cookies or page tags (“web beacons”), for example. For more information about this and data protection at Survey Monkey, please see the privacy policy: https://www.surveymonkey.de/mp/legal/privacy/ and https://www.surveymonkey.de/mp/legal/survey-page-cookies/.

Depending on the survey and the specific design, the legal basis in each case is Article 6 (1) (f) of the GDPR or your consent, which can be withdrawn at any time with effect for the future, pursuant to Article 6 (1) (a) of the GDPR.

SurveyMonkey Europe UC is a subsidiary of SurveyMonkey Inc., which is based in the USA. It cannot be excluded that your data collected by SurveyMonkey may also be transferred to the USA.

There is a risk that authorities in third countries may access the data for security and surveillance purposes without notifying you or allowing you to seek legal remedy.

We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks.

5.5. Data processing for communication processing by customer services/telephone services
If you contact us by post, telephone, e-mail or any other means of communication outside of the aforementioned processing operations and without reference to the processing purposes, we will process your personal data which is associated with the use of the means of communication and which you provide to us in the course of contacting us for the purpose of and in the interest of responding to your enquiry in the most straightforward, timely and customer-oriented manner possible.

The legal basis for processing your data is Article 6 (1) (f) of the GDPR.

5.6. Data processing for the assertion, exercise or defence of legal claims, cooperation with debt collection agencies
We also process your data in individual cases for the purpose and in the interest of asserting, exercising and defending legal claims, provided that your data relates to a legal dispute.

The legal basis for processing your data is Article 6 (1) (f) of the GDPR.

If necessary, your data will be transmitted to investigating authorities, debt collection agencies, lawyers, experts, courts or bailiffs in individual cases to the required extent.

5.7. Data processing to document compliance with data protection
If you provide us with a declaration of consent on our web pages, we will process your personal data to be able to prove that you have consented to the data processing in question within the scope of the accountability incumbent upon us pursuant to Article 5 (2) of the GDPR.

If you exercise your data subject rights under the GDPR against us, we also process your personal data to be able to prove, within the scope of accountability pursuant to Article 5 (2) of the GDPR, that we have complied with the GDPR when processing your request.

In addition, we may forward your personal data in connection with your request to our company data protection officer at datenschutz süd GmbH, Wörthstraße 15, 97082 Würzburg, which advises us on all data protection issues and, in particular, supports us with processing enquiries from data subjects in connection with the assertion of the rights mentioned in Section 9 below.

In each case, processing takes place on the basis of Article 6 (1) (c) of the GDPR.

To document your request in a way that is compliant with data protection regulations and to be able to fulfil accountability according to Article 5 (2) of the GDPR, we or datenschutz süd GmbH will store the necessary data for three years from the end of the year in which your request is responded to.

5.8. Data processing for the fulfilment of other legal obligations
Finally, we will process personal data if this is necessary to fulfil a legal obligation.

The legal basis for the processing of your data in these cases is Article 6 (1) (c) of the GDPR in conjunction with the respective legal standard that imposes such an obligation on us.

If necessary, your data will be transmitted to auditors, financial or investigating authorities, lawyers, experts or courts in individual cases to the required extent.

6. Recipients of personal data
As already stated for individual data processing, your data is transmitted to various recipients and service providers who support us, as an example, with operating our web pages, our online shop and with other data processing services and the associated processes (e.g. transportation, debt collection, etc.). If necessary, we have concluded commissioned processing agreements with them in accordance with Article 28 of the GDPR.

If data processing also takes place outside the EU or EEA in third countries, there is a risk that authorities in third countries may access the data for security and monitoring purposes without informing you or allowing you to seek legal remedy. We therefore take measures in accordance with Article 44 et seq. of the GDPR to ensure an adequate level of data protection despite these risks, for example by concluding standard contractual clauses with our service providers together with further technical measures.

If the requirements of data protection law are met, we may transfer data concerning you to our affiliates within the Diethelm Keller Group in countries where our brand is represented.

For the purpose and in the interest of preparing and carrying out the sale of individual legal assets of our company or individual parts of our company for the purpose of making a profit, we may transmit personal customer data to purchasers. The legal basis for this is Article 6 (1) (f) of the GDPR.

7. Storage period
If a specific storage period is not separately indicated where data processing is detailed above, we process your data required to achieve the aforementioned purposes or where separate consent is given to a longer storage period.

We then erase your data from all of our operational systems.

We will proceed in the same way if, in the case of processing on the basis of consent given to us pursuant to Article 6 (1) (a) of the GDPR, you exercise your right of withdrawal pursuant to Article 7 (3) of the GDPR or, in the case of processing on the basis of legitimate interests pursuant to Article 6 (1) (f) of the GDPR, you exercise your right to object pursuant to Article 21 of the GDPR and the conditions set out therein are met.

In particular, if in the event of your objection there are demonstrably compelling legitimate grounds for further processing by us which outweigh your interests, rights and freedoms as a data subject, this would continue to be permissible. The same applies if processing serves the assertion, exercise or defence of legal claims by us.

If the fulfilment of a legal obligation to retain data to which we are bound precludes deletion, we will transfer the data concerned to archives and restrict further processing for the duration of the storage period. In this case, the data will only be permanently erased after the storage period has expired.

8. Voluntary nature of the provision of your data
The provision of your personal data is not required either for legal or contractual purposes.

However, in certain cases, it is necessary for you to be able to use the services and benefits offered on our web pages.

If you do not provide us with personal data, our web pages may be restricted in their functionality or you may be unable to use the services offered.

9. Your rights
When processing your personal data, the GDPR grants you certain rights:

9.1. Right of access (Article 15 of the GDPR)
You have the right to obtain confirmation as to whether personal data concerning you is being processed; if this is the case, you have the right to be informed about such personal data and to receive the information listed in detail in Article 15 of the GDPR.

9.2. Right to rectification (Article 16 of the GDPR)
You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and, where appropriate, the completion of any incomplete personal data.

9.3. Right to erasure (17 of the GDPR)
You also have the right to request the erasure of personal data concerning you without undue delay, provided that one of the reasons listed in detail in Article 17 of the GDPR applies, e.g. if the data is no longer required for the purposes pursued.

9.4. Right to restriction of processing (Article 18 of the GDPR)
You have the right to request the restriction of processing, provided that one of the conditions listed in Article 18 of the GDPR is met, e.g. if you have objected to processing pursuant to Article 21 of the GDPR or for the duration of any review as to whether our legitimate interests override your interests as a data subject.

9.5. Right to data portability (Article 20 of the GDPR)
In certain cases, set out in Article 20 of the GDPR, you have the right to obtain the personal data concerning you in a structured, commonly used and machine-readable format or to request the transmission of such data to a third party.

9.6. Right to object (Article 21 of the GDPR)
If data is collected on the basis of Article 6 (1) (f) of the GDPR (data processing to protect legitimate interests), you have the right to object to the processing at any time for reasons arising from your particular situation. We will then no longer process the personal data unless there are demonstrably compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

9.7. Right of withdrawal (Article 7 [3] [1] of the GDPR)
If your personal data is processed on the basis of consent pursuant to Article 6 (1) (a), you have the right to withdraw your consent pursuant to Article 7 (3) of the GDPR. You can withdraw your consent at any time with effect for the future.

9.8. Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR)
Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority if you are of the opinion that the processing of data concerning you violates data protection regulations. The right to lodge a complaint can particularly be asserted with a supervisory authority in the Member State in which you reside, in which your place of work is located, or in the location of the suspected violation.

Our competent supervisory authority is.

10. Data protection officer contact details
Our company data protection officer will be happy to provide you with information or suggestions on the subject of data protection. For this purpose, please contact:

datenschutz süd GmbH

Key word: “Outdoorchef – EU Datenschutzerklärung | 01.03.2021”
Wörthstraße 15
97082 Würzburg
E-mail: office@datenschutz-sued.de
Telephone: 0931 304 976 0
Web: www.datenschutz-nord-gruppe.de
E-mail office@datenschutz-sued.de

11. Changes to this privacy policy

This privacy policy was last updated on 01/03/2021.